Privacy Policy — ZephyrFit
This page covers ZephyrFit. ZephyrRun is designed differently and has its own policy.
Zephyr Lab (“Zephyr Lab,” “we,” “us,” or “our”) operates ZephyrFit and ZephyrRun. This Privacy Policy explains what information our apps access or collect, how that information is processed and stored, and the choices you have when using ZephyrFit or ZephyrRun (collectively, the “Services”).
ZephyrFit and ZephyrRun are designed differently. ZephyrFit is a cloud-backed service that stores fitness data you choose to provide or sync. ZephyrRun processes your fitness and activity data locally on your device and does not upload that data to Zephyr Lab.
If you do not agree with this Privacy Policy, please do not use the Services.
Data We Collect
Account Information
When you create or use a ZephyrFit account, we may collect:
- your email address
- your name
- login method information, such as Sign in with Apple if you use it
Fitness Data
ZephyrFit is a fitness data recording and analytics app. We collect and store the fitness data you choose to create, import, or sync through ZephyrFit, including information such as:
- workouts and workout sessions
- meals, food entries, and macro goals
- body measurements
- notes and related fitness records
Device Health Data
If you enable device health integrations, ZephyrFit reads health and fitness data on your device according to the permissions you grant.
- Detailed device health data, such as GPS points, heart rate series, and activities, is read on your device and stays there. It is never uploaded to Zephyr Lab.
- Your age, gender, and basic fitness information are synced across your account, whether you enter them yourself or ZephyrFit reads them from your device health platform.
You can control these permissions through your device settings.
Technical and Support Information
We may also receive:
- connection and request metadata such as IP address and basic network information
- device and app information needed to operate and secure ZephyrFit
- information you send us when you contact support
How We Use ZephyrFit Data
We use information collected through ZephyrFit to:
- create and manage your account
- authenticate you
- store and sync your fitness data
- provide features and analytics requested by you
- provide customer support
- secure the service, prevent abuse, and troubleshoot issues
- maintain and improve ZephyrFit
We do not sell your personal information.
We do not use your personal information, including data read from Apple Health or Android Health Connect, for advertising, marketing, or data brokerage purposes.
How ZephyrFit Stores Data
ZephyrFit is a cloud-backed service. Fitness data that you choose to record, import, or sync is stored on ZephyrFit’s servers so that we can provide synchronization and core app functionality. The exception is detailed device health data, which stays on your device (see Device Health Data above).
ZephyrFit separates account identity and fitness data across different systems.
- The account system stores account-related information such as login and account data.
- The fitness system stores fitness records associated with a randomly generated identifier rather than directly labeling those records with your identity.
This design is intended to reduce direct linkage between identity and fitness records in storage. This is pseudonymization, not anonymity.
Strict Mode
ZephyrFit offers an optional feature called Strict Mode.
When Strict Mode is enabled:
- linkage credentials are encrypted on your device before being sent to ZephyrFit
- your passcode is not sent to or stored by ZephyrFit
- ZephyrFit cannot decrypt those credentials without your passcode
Strict Mode does not mean that all fitness data is end-to-end encrypted. ZephyrFit still processes and stores account and fitness data on its servers to provide synchronization and core app functionality.
If you forget your passcode, you may lose access to your fitness data. We cannot recover your passcode for you.
ZephyrFit Data Retention
We keep live account data and live fitness data until you delete your account, request its deletion, or your account is otherwise removed. You can delete your account in the app under Settings › Data & privacy › Delete account; accounts created with Sign in with Apple are deleted by emailing support@zephyrlab.ca (see Your Rights and Choices below).
We do not intentionally keep long-term logs beyond what is reasonably necessary to operate, secure, and troubleshoot ZephyrFit, although system software and infrastructure may generate temporary logs automatically.
We create database backup snapshots for operational and recovery purposes. Deleted data may remain in backup snapshots for an extended period and may not be removed immediately from those backups.
When you delete your account, or when we process a deletion request, we aim to remove your live account data and live fitness data from our production systems, subject to legitimate retention needs such as security, fraud prevention, legal compliance, and backup recovery limitations.
Third Parties and Service Providers
For cloud-backed portions of our Services, we may use third-party service providers to operate infrastructure and supporting functions.
ZephyrFit currently uses service providers including:
- Cloudflare for network routing, security, and related infrastructure functions
- Resend for email verification and email delivery
These providers may process limited personal information as necessary to provide their services.
Data Location
Our core network and server infrastructure for cloud-backed services is hosted in Canada.
Some service providers may process limited information in other countries depending on how their infrastructure operates. As a result, information processed through our cloud-backed services may be processed in jurisdictions outside your province, state, or country.
Your Rights and Choices
You can delete your ZephyrFit account in the app under Settings › Data & privacy › Delete account.
In-app deletion is not available for accounts created with Sign in with Apple. If you signed up that way, request deletion by emailing support@zephyrlab.ca.
For personal information held by Zephyr Lab, you may also request access to or correction of your personal information by contacting support@zephyrlab.ca.
Legal Basis
Where applicable law requires a legal basis for processing, we process personal information as necessary to provide the Services you request, based on your consent where applicable, and for legitimate interests such as operating, securing, and maintaining our Services.
Children
ZephyrFit is for adults 18 and over, and setup does not continue if the date of birth entered is under 18. ZephyrRun is not directed to children under 13. We do not knowingly collect personal information from anyone under the minimum age for the app they use.
If you believe someone under 18 has provided personal information to us through ZephyrFit, or a child under 13 through ZephyrRun, please contact us at support@zephyrlab.ca and we will take appropriate action.
Changes to This Policy
We may update this Privacy Policy from time to time.
If we make material changes, we may update the “Last updated” date above and take other reasonable steps to notify users where appropriate.
Contact
If you have questions about this Privacy Policy or want to make a privacy-related request regarding information held by Zephyr Lab, contact support@zephyrlab.ca.